Australia Cyber Security Act Smart Device and Ransomware Reporting Hub

Check connectivity, intended or likely household use, Australian consumer acquisition, the six product exclusions, and whether you act as manufacturer or supplier before applying the password, security-issue reporting, support-period, and statement duties. The Australian Consumer Law test can cover a business acquisition, including goods priced at no more than the prescribed $100,000 amount, but excludes goods acquired for resale or for specified production, manufacture, repair, or treatment uses. The statement is a retained regulatory record and need not be physically provided at the point of sale.

Check whether the entity is responsible for a critical-infrastructure asset covered by Part 2B of the Security of Critical Infrastructure Act 2018, the mandatory cyber incident notification regime for specified assets, or carries on business in Australia above the $3 million previous-year turnover threshold. The turnover limb excludes Commonwealth and State bodies and responsible entities for critical-infrastructure assets. Section 26 says turnover must exceed the threshold. The current government form says "equal to or exceeds $3 million," so an entity at exactly $3 million should confirm the filing position promptly. If the remaining incident, demand, and payment conditions are met, the report is due within 72 hours of the payment or awareness trigger.

Understand how CIRB reviews focus on learning from certain cyber security incidents, public reporting, sensitive information redaction, and non-interference with investigations or proceedings.